OwnFramework Loop v0.9.1 — Host Capability Runtime

OwnFramework Loop v0.9.1 — Host Capability Runtime

Frozen release target: d23cadc

This is the canonical official publication of the v0.9.1 closed source/master
line. The release is immutable; release tags are historical truth and are
not rewritten.

10/10 hosted CI lanes are green at the frozen release target:

• security
• adapter-contract
• claude-adapter
• codex-adapter-static
• core Ubuntu Python 3.12
• core Ubuntu Python 3.13
• core macOS Python 3.12
• core macOS Python 3.13
• release-gate Python 3.12
• release-gate Python 3.13

The canonical 87/87 release gate is also green locally.

What 0.9.1 delivers

Portable host capability runtime

• Packets may declare portable semantic capabilities; the trusted runtime
  resolves exact host executables, versions, read/write paths, and derived
  network authority before the model starts.
• Every semantic attempt receives an immutable capability-resolution receipt
  referencing a run-level CAPABILITY_BINDING.json; stable capability,
  host-manifest, network, privileged-canary and runner-profile identity is
  exact-matched before every later model launch.
• ofloop capabilities probe|preflight|fingerprint|profile|commission
  exposes host inventory, named runner profiles, and trusted privileged-canary
  commissioning without a semantic model call.
• HOME remains broadly denied; tools discovered under HOME now require
  explicit operator commissioning instead of relying on contradictory PATH
  discovery.
• Per-pass scratch is separated from durable repository-scoped package and
  browser caches, preventing repeated downloads without introducing
  cross-client writable-cache poisoning.
• Privileged container.docker is broker-only: direct daemon sockets,
  inherited Docker/Kubernetes/agent IPC selectors, and unsandboxed Docker
  exceptions are never granted; conventional Docker/Podman/containerd daemon
  sockets are explicitly denied, and the Bash guard requires the resolved
  privileged capability marker before Docker invocation, including common
  shell-wrapper forms.
• local.http-service is explicit and unavailable until a safe local-binding
  provider is commissioned and proven for the exact host runtime.
• Privileged and local authority requires core-receipted trusted canary
  evidence bound to platform/architecture/Claude runtime, provider/broker
  identity, and executable digests; a copied runtime fingerprint alone is
  insufficient.
• Trusted named runner profiles can select only model and effort, are frozen
  into run identity, and cannot override sandbox/tool/MCP/session authority.
• Funded supervisor runs propagate their exact remaining durable cost
  ceiling to Claude's native print-mode per-pass budget while aggregate
  Loop accounting remains canonical; reviewer tool caches remain
  pass-ephemeral.
• Capability-resolution failures are terminalized as proven pre-provider
  semantic attempts instead of leaving a reserved attempt for stale recovery.

Terminal source hardening

• Semantic replay is authorized only after durable resource accounting and
  an explicit acceptance publication bound to the exact semantic artifact
  digest and role-specific candidate identity; drifted bytes or candidate
  identity fail closed without a second semantic charge.
• Preflight output carries the same proved effort-attestation identity used
  at launch and marks explicit manifest/profile overrides as diagnostic
  rather than launch-parity evidence.
• Redacted secret scanning refuses unreadable or oversized inputs instead
  of collapsing unknown scan state into a clean result.
• Browser runtime proof binds the top-level Playwright version to the
  verified installed distribution identity and rejects contradictory proof.
• Source authority, recovery, claim ownership, cost accounting, capability
  binding, browser identity, runner-profile truth, secret scanning,
  worktree ownership, and state/event integrity remain covered by the
  canonical multi-platform release gate.

Public contract and runner normalization

• Durable supervisor runner availability is now explicit and distinct from
  adapter installation; unsupported --runner values are refused before a
  job row can be created, while Codex remains an experimental foreground
  Agent-Skills adapter rather than an implied unattended runner.
• Commissioned Claude model selection is documented as packet/profile truth:
  restricted workers do not inherit interactive settings.json; named
  operator profiles bind explicit model/effort policy before provider launch.
• Claude and Codex coordinator skills are parity-gated on critical authority
  doctrine so duplicated host UX cannot silently drift.
• Packet examples are executable documentation validated by the current
  packet admission path, including a modern v3 PROGRAM example with
  checkpoint-scoped acceptance and runner/capability declarations.

Repository hygiene

• Operator-facing adapter and supervisor lifecycle commands live under
  bin/; platform-specific service implementations live under
  scripts/supervisor/; repository root retains only the deliberate core
  install, uninstall, validation, and release-gate entrypoints.
• Maintained docs, templates, scripts, and tests now have explicit indexes;
  one-off implementation reports and retired policy examples are absent
  from the active repository surface while provenance-bearing regression
  names are retained.

Material limitations preserved

• Claude Code is the first production-hardened unattended semantic runner;
  other adapters are not equivalent commissioned unattended runners.
• Codex remains experimental/static-distribution proven; it is not an
  equivalent commissioned unattended runner.
• Native Windows is not a commissioned-supervisor target.
• WSL user service does not itself keep the WSL VM alive.
• APPROVED does not authorize push, merge, deploy, publish, payment,
  messaging, or any unrelated external effect; promotion remains
  human-controlled.
• Deferred defense-in-depth observations (executable symlink rejection in
  the host-manifest executable field, a read_paths policy gate against
  sensitive directories, and platform-specific os.link(2) semantics
  for broken symlink targets) remain unreachable through the current
  production authority path because every authority artifact is owner-gated
  by manifest ownership, installation-time mode and ownership checks, and
  Python's portable atomic-write pattern; they are not patched here.

OwnFramework Loop v0.8.4

0.8.4 - Autonomous Runtime Portability and Containment (2026-08-30)

A post-closure adversarial sweep exercised failure/containment paths that the
successful 0.8.3 live PROGRAM canary did not.

Vendor-neutral runtime topology

• install.sh now owns a versioned vendor-neutral OwnFramework Loop core;
  Claude/Codex integrations are optional adapters installed independently;
• the durable supervisor is commissioned from that core rather than a Claude
  plugin cache;
• install-supervisor.sh selects launchd on macOS or systemd-user on Linux;
• both platform installers use one shared read-only runtime-dependency probe for
  live-work and runtime-generation replacement safety;
• installed-core discovery/validation resolves from the managed ofloop
  launcher rather than an agent/plugin registry;
• Linux Claude commissioning proves Claude Code >=2.1.248, bubblewrap, socat,
  and a usable native sandbox before starting unattended work;
• adapter uninstall preserves the core; supervisor uninstall preserves
  ledger/evidence while removing service provenance.

Dead-surface and runtime hygiene

• removed the retired pre-0.6 ofloop loop run orchestrator/parser;
• removed deprecated build write-receipt and review write-verdict parser
  stubs; deterministic finalize remains the sole receipt/verdict path;
• removed the legacy Claude skills-directory rollback.sh root command;
• verified recovery removes a dead .EVENTS.log.append.tmp under the run
  flock;
• durable DONE performs/retries disposable runtime-cache GC while QUARANTINED
  cache and durable worker/attempt evidence remain preserved.

Crash-atomic protocol state

• STATE.json + EVENTS.log mutations now use a per-run write-ahead
  STATE_TXN.json intent and deterministic recovery;
• standalone EVENTS.log append is atomic old-or-new rather than an in-place
  JSONL tail write;
• critical semantic/execution call sites consume verified state instead of raw
  STATE.json bytes;
• caller event extras may not overwrite run/state/event-chain identity or spoof
  the internal state_txn_id recovery marker.

Supervisor lifecycle parity

• the shared runtime-dependency probe treats DONE + RETIRED as
  non-runtime-dependent historical enrollment states for core install,
  launchd/systemd commissioning, and removal;
• retirement additionally refuses unresolved semantic_attempt rows even if the
  job-level worker PID is absent/dead.

Sealed unattended Claude worker

• commissioned workers require Claude Code 2.1.248+ and use the native --restricted shared-machine boundary;
• Bash sandbox is fail-closed with a strict packet-bound network read
  allow-list (empty by default) and unsandboxed-command escape disabled;
• optional network_read_allowlist is frozen SPEC authority and maps directly
  to Claude's native sandbox.network.allowedDomains; exact hostnames only,
  no runtime prompt/widening;
• user/project/local settings are excluded by --restricted; built-in file tools are confined to the pass working directory;
• inherited MCPs are disabled with strict empty MCP configuration;
• builder and reviewer have different native tool sets: builders get Read/Edit/Write/NotebookEdit/Bash/Glob/Grep; reviewers get Read/Bash/Glob/Grep only; no WebSearch/WebFetch, Agent/Task, Skill, browser, or nested orchestration inside the sealed pass;
• historical OFLOOP_CLAUDE_ALLOWED_TOOLS environment tuning cannot widen the
  product-owned semantic tool boundary;
• --permission-mode dontAsk plus pre-approved sealed tools and sandbox auto-allow eliminate routine permission prompts without using bypassPermissions (which restricted mode intentionally refuses);
• Bash read access denies the operator home except narrow current-pass/runtime re-opens, and subprocess credentials are scrubbed/denied;
• authority-sensitive extra CLI flags are refused before Claude starts.

Research/integrations remain outside sealed BUILD/REVIEW passes. Promotion and
external mutation remain operator-owned outside Loop.

Adapter auth and local-state privacy

• durable service provider/auth/model environment moved out of launchd/systemd
  definitions into a Loop-owned service-env.json file;
• supervisor startup loads only an explicit auth/model whitelist and refuses
  loose permissions, foreign ownership, symlinks, malformed JSON, and unknown
  keys;
• macOS no longer reopens all of ~/.claude; OAuth remains Keychain-backed;
• Linux may reopen only the exact private .credentials.json file (including
  CLAUDE_CONFIG_DIR when used), never the full Claude configuration tree;
• state/runtime-cache directories are explicitly 0700; supervisor DB, worker
  logs, service definitions, provenance, secret files, and replacement backups
  are explicitly 0600 where POSIX modes apply;
• provider bearer-token values are absent from service definitions and runtime
  provenance.

Regression proof

The canonical v0.8.4 tests fault-inject state/event crash windows, prove
unexplained tampering remains refused, verify authority-bearing state reads,
exercise the worker sandbox/settings/version boundary, prove RETIRED managed
lifecycle parity, cover unresolved-attempt retirement refusal, validate
vendor-neutral core install/discovery/uninstall, and exercise Linux systemd-user
commissioning alongside macOS launchd parity.

Durable commissioned restart coordination

• a typed, per-run PROGRAM_CHECKPOINT_BOUNDARY dispatch hold is enrolled
  atomically with the supervisor job and remains separate from the engineering
  state machine and jobs.status lifecycle;
• the supervisor evaluates authoritative verified PROGRAM state before job
  claim, semantic-attempt reservation, provider release, or worker launch;
• the one-shot hold survives supervisor restart, prevents CP-2 reservation at
  the CP-1-approved boundary, and is released only after durable restart proof;
• the commissioned canary watcher consumes the held ledger state, records
  atomic restart evidence, and preserves terminal hold history.

Final commissioned closure

• Sealed human-originated SPEC authority drives unattended deterministic BUILD/REVIEW orchestration with exact-SHA review and bounded reviewer-funded repair.
• PROGRAM checkpoints continue under crash-atomic STATE/EVENT handling, exact semantic-attempt ownership, persisted semantic deadlines, exact process identity, orphan recovery, repair-entitlement atomicity, and idempotent finalizer replay.
• Commissioned lifecycle uses the exact Python runtime with launchd/systemd-user support, fail-closed ledger handling, runtime-generation safety, installation/rollback transaction safety, and source-to-installed parity.
• CI and release evidence are exact-SHA pinned; commissioned security containment proves the restricted Claude worker boundary and zero unauthorized external effects.
• Build-validation retry is distinct from reviewer-funded repair.
• The final real two-checkpoint PROGRAM canary proved six semantic attempts in the sequence builder, reviewer, builder, reviewer, builder, reviewer; CP-1 used exactly one reviewer-funded repair, the durable restart watcher consumed a one-shot per-run dispatch hold at the CP-1 -> CP-2 boundary, the supervisor restarted exactly once, and CP-2 continued automatically to APPROVED with zero duplicate, lost, or wrong-SHA semantic work.

This release is the empirically commissioned serial baseline. Bounded multi-repository concurrency, multiple active jobs, distributed workers, second production providers, autonomous promotion, and arbitrary allowlisted-host protocol-level read-only semantics are outside this release.

OwnFramework Loop v0.6.0 — Durable Supervisor Architecture

OwnFramework Loop v0.6.0

OwnFramework Loop v0.6.0 moves unattended engineering from session-scoped
polling to a durable execution supervisor while preserving a deterministic,
agent-neutral engineering core.

What changed

Durable unattended execution

OwnFramework Loop now has a durable supervisor capable of driving a bounded
engineering mission through BUILD, REVIEW, repair rounds, and PROGRAM
checkpoints without keeping an interactive agent session alive.

The supervisor owns only operational concerns such as process lifetime, queue
state, retry/backoff, quarantine, observed cost, and runtime ceilings.

Repository artifacts remain authoritative for engineering state, candidate
identity, review identity, repair lifecycle, and terminal verdicts.

Atomic dispatch

The deterministic core exposes one typed work-order boundary:

• BUILD
• REVIEW
• WAIT
• TERMINAL

The supervisor does not implement a second engineering state machine.

Human-originated specification, no execution ceremony

SPEC remains human-originated.

Once a legitimate bounded work packet exists, normal execution does not
require:

• a confirmation token;
• a mandatory approval command;
• manual PROGRAM initialization;
• approval between builder/reviewer passes;
• approval between PROGRAM checkpoints.

The first legitimate execution start creates the immutable execution binding.

Semantic builder and reviewer passes are mandatory

A deterministic build finalizer can no longer substitute for a semantic
builder.

A deterministic review finalizer can no longer manufacture APPROVED without a
semantic reviewer assessment.

Review remains tied to the exact candidate SHA.

Crash/restart recovery

Supervisor commissioning proves:

• worker PID/process ownership;
• no duplicate worker while a live orphan exists;
• same-pass replay after supervisor restart;
• no duplicate engineering-pass consumption;
• zero-model finalization of an already-completed semantic artifact;
• exact-once observed cost accounting.

Hermetic exact-SHA review

Python bytecode, pytest cache, temporary files, and XDG cache state are kept
outside exact-SHA builder/reviewer worktrees.

The dirty-worktree invariant remains strict: real unexpected tracked or
untracked mutation is still refused.

Operational limits

The supervisor supports bounded:

• infrastructure retries;
• exponential backoff;
• operational quarantine;
• model-cost ceilings;
• wall-clock ceilings;
• explicit operational resume.

Infrastructure failure does not fabricate semantic BLOCKED state.

Claude Code reference runner

Claude Code is the first live, commissioned semantic runner and remains the
reference adapter.

Existing interactive Claude UX remains useful:

/loop /of-loop:build <run-id>
/loop /of-loop:review <run-id>

/loop is no longer the canonical overnight execution clock.

Portable host model

The protocol remains host/agent-neutral.

Codex distribution and protocol compatibility continue to be tested, while
Codex should not be described as having the same live commissioning or
hardening maturity as the Claude reference runner unless separately proven.

Promotion stays outside Loop

APPROVED means eligible for operator promotion.

OwnFramework Loop does not autonomously:

• push;
• merge;
• deploy;
• publish;
• send messages;
• make payments;
• perform unrelated external actions.

Current executable packets require human-controlled promotion.

Validation

v0.6.0 was commissioned with:

• real Claude builder/reviewer execution;
• a real repair cycle;
• multi-checkpoint PROGRAM execution;
• supervisor kill/restart recovery;
• launchd supervision on macOS;
• hermetic exact-SHA reviewer validation;
• 32 canonical tests;
• Linux/macOS CI;
• Python 3.12/3.13 release gates;
• Claude adapter validation;
• Codex static adapter validation;
• adapter conformance;
• security scanning.

Maturity

OwnFramework Loop remains an early public release.

Protocol compatibility does not imply equal host hardening, authenticated
runtime maturity, or operating-system sandbox containment across adapters.